Zum Inhalt springen
dialogis.ai

Deutsch

Tenant Banner for Microsoft 365 – Guide for IT departments

Many organizations block browser extensions on managed devices. This guide shows how to allow Tenant Banner for Microsoft 365 for your admins – or install it for them automatically – with Intune or Group Policy, and what the extension can and cannot access.

What it does

Tenant Banner puts a colored frame and a name label around Microsoft admin portals, so admins always see which (customer) tenant they are working in. It is built for IT admins and MSPs who switch between tenants every day.

Security and privacy at a glance

  • No own server, no AI, no tracking, no analytics.
  • The tenant list and settings are kept in the browser’s extension storage (chrome.storage.sync). If browser sync is turned on, the browser syncs them between the user’s own devices. The extension itself sends them nowhere.
  • Only network connection: the license check with Polar (api.polar.sh) – and only if a Pro license has been activated. Sent are the license key, the activation ID and, on activation, a short label such as “Chrome · Windows · 2026-10-29” – nothing about tenants, users or pages.
  • The extension only reads what the admin portal shows anyway (account menu, page address, the page’s own sign-in cache) to recognize the tenant. It never changes anything in the portals and does not make requests to Microsoft.
  • Exports (CSV, Markdown) are created on the user’s computer only when the user clicks the export button.
  • Privacy policy: https://dialogis.ai/tenant-banner/privacy

Permissions

Permission Why
storage Saves the tenant list, colors, favorites and the license status in the browser.
scripting Reads the visible table or page content for the Pro export, only when the user starts an export. Also turns the SharePoint admin center on or off when the user changes that setting.
alarms Daily offline-tolerant license check (Pro only).
Host access to portal.azure.com, entra.microsoft.com, intune.microsoft.com, endpoint.microsoft.com, admin.microsoft.com, admin.cloud.microsoft, security.microsoft.com, admin.teams.microsoft.com, *.reactblade.portal.azure.net, *.hosting.portal.azure.net Shows the frame and label in these admin portals; the two Azure helper domains are frames inside the Azure portal that the export reads.
partner.microsoft.com dashboard pages (content script only) Shows a neutral “Partner Center – own tenant” label. Reads nothing.
api.polar.sh License check (see above).
*.sharepoint.com – optional Not requested at install. Only when a user turns on “SharePoint admin center” in the settings. The extension then only acts on <organization>-admin.sharepoint.com.

Extension IDs

Browser Extension ID Update URL
Google Chrome (Chrome Web Store) dopnoeibgjdmeklgimjagjhhaocoodgk https://clients2.google.com/service/update2/crx
Microsoft Edge (Edge Add-ons) ckfhmdhcdgloclofchonaeoaeeclnnko https://edge.microsoft.com/extensionwebstorebase/v1/crx

Option A – Allow it (users install it themselves)

The user installs the extension from the store. Your existing block of all other extensions stays in place: an allowlist entry overrides a block of *.

Intune (Settings catalog):

  1. Devices › Configuration › Create › New policy, platform Windows 10 and later, profile type Settings catalog.
  2. Add settings:
    • Chrome: Google Chrome › Extensions › Configure extension installation allow list
    • Edge: Microsoft Edge › Extensions › Allow specific extensions to be installed
  3. Enable the setting and add the extension ID:
    • Chrome: dopnoeibgjdmeklgimjagjhhaocoodgk
    • Edge: ckfhmdhcdgloclofchonaeoaeeclnnko
  4. Assign the policy to the admin users or devices.

Group Policy / registry: policy ExtensionInstallAllowlist, e.g.

HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist   "1" = "dopnoeibgjdmeklgimjagjhhaocoodgk"
HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist  "1" = "ckfhmdhcdgloclofchonaeoaeeclnnko"

(Use the next free number instead of 1 if the list already has entries.)

Option B – Install it automatically

The extension is installed silently and users cannot remove it.

Intune (Settings catalog):

  • Chrome: Google Chrome › Extensions › Configure the list of force-installed apps and extensions
  • Edge: Microsoft Edge › Extensions › Control which extensions are installed silently

Value:

  • Chrome:
dopnoeibgjdmeklgimjagjhhaocoodgk;https://clients2.google.com/service/update2/crx
  • Edge:
ckfhmdhcdgloclofchonaeoaeeclnnko;https://edge.microsoft.com/extensionwebstorebase/v1/crx

Group Policy / registry: policy ExtensionInstallForcelist with the same values.

If the frame does not appear

  • Check chrome://policy or edge://policy – is the policy applied?
  • Check chrome://extensions or edge://extensions – is the extension installed and on?
  • If you use ExtensionSettings with runtime_blocked_hosts (for example *://*.microsoft.com), the extension is installed but not allowed to run in the admin portals. Exclude it for this extension ID.
  • The tenant list itself is maintained by each user in the extension’s settings. Central pre-configuration of tenants via policy is not available.

Licenses

Free for up to 5 tenants. Pro (one-time purchase, no subscription): unlimited tenants, copy page IDs, favorites per tenant, export. Team licenses for 10, 20 or 50 browsers. Purchase via Polar.

Contact

DIALOGIS Nuhi · support@dialogis.ai

Microsoft and the Microsoft product names mentioned are trademarks of the Microsoft group of companies. Chrome is a trademark of Google LLC. This extension is not affiliated with or endorsed by Microsoft or Google.